After creating a VM on Google Cloud, you will find you cannot log in with a password through PuTTY or any other SSH client. That is deliberate: Google Cloud accepts SSH keys only by default, and the root account has no password set.

The steps below were done on CentOS 7, but other Linux distributions work the same way.

Think about this first

Let me be clear before anything else: enabling root password login on a machine with a public IP meaningfully reduces its security.

Public servers get hit with automated password guessing constantly, and root is always the first account tried because it definitely exists on every Linux system. With SSH keys, guessing is not feasible. With passwords, your safety depends entirely on how strong the password is.

If you decide to go ahead anyway, read the mitigation section at the end. And if you only need to reach the server from another machine, SSH keys are still the better route and not much more work.

The steps

Open the browser terminal Google provides (the SSH button in the VM instances list) and work through these in order.

Step 1: switch to root

sudo su

Step 2: set a password for root

sudo passwd

Google Cloud does not create a password for root, so this is the first time that account gets one. You will be asked to enter it twice.

Pick something genuinely long. It is the only thing standing between your server and thousands of automated attempts a day.

Step 3: allow password authentication in SSH

Open the SSH daemon config:

vi /etc/ssh/sshd_config

Find and set these two lines:

PermitRootLogin yes
PasswordAuthentication yes

Both are usually set to no, or commented out with a # at the start of the line. If there is a #, delete it, because a commented line does nothing.

If you are not used to vi: press i to enter insert mode, make your edits, press Esc, then type :wq and Enter to save and exit.

On newer distributions the config can be overridden by files in /etc/ssh/sshd_config.d/. Google Cloud usually drops a file there with PasswordAuthentication no. Check with:

grep -r "PasswordAuthentication" /etc/ssh/

If you find a line setting it to no inside sshd_config.d, you have to fix it there too, because those files are loaded afterwards and win.

Step 4: restart the SSH service

service sshd restart

Or on a systemd based system:

systemctl restart sshd

Checking the syntax before restarting is a good habit, so a bad config file does not leave the SSH service unable to start:

sshd -t

The command prints nothing if the config is valid.

Testing

Keep the browser terminal window open, do not close it. If something goes wrong, it is your only remaining way in.

Open PuTTY or a terminal on your own machine and try:

ssh root@YOUR_IP_ADDRESS

Do not forget the Google Cloud firewall

Google Cloud has its own firewall layer, separate from the one inside the operating system. If the connection hangs with no error at all, port 22 is probably not open under VPC network > Firewall.

Reducing the risk

If you have enabled password authentication, do at least the following.

Restrict which IPs can connect. This is the single most effective measure. In the Google Cloud firewall rule, instead of opening port 22 to 0.0.0.0/0, allow only your own IP range.

Change the SSH port. Not real security, but it removes most of the automated scanning aimed at port 22:

Port 2222

Remember to open the new port in the Google Cloud firewall before you restart SSH, otherwise you lock yourself out.

Install fail2ban to automatically block IPs after repeated failed logins:

yum install epel-release -y
yum install fail2ban -y
systemctl enable --now fail2ban

Create a normal account instead of using root. Log in with an account that has sudo, elevate when needed, and keep PermitRootLogin no. That gives you the convenience of password login without exposing the most important account on the box.

Turn it back off when you are done. If you only needed password login for a one-off task, remember to set both values from step 3 back to no afterwards.